Questions, answered.

Cylanto is an automated compliance platform. It discovers your technology stack, maps it to every framework you answer to, and puts a room of AI experts on call, with every answer traced back to its source.

SOC 2, ISO 27001, PCI DSS, NIST CSF 2.0, GDPR, ISO 42001, the EU AI Act and Hong Kong's PDPO.

Evidence links to a control, not a single requirement, so one piece of evidence counts towards every framework that control serves.

Book a demo. We start with a discovery of your own domain, walk you through what we found and the frameworks that apply, and show you where your evidence already stands.

No. Cylanto runs in your browser. Discovery starts from the outside: DNS, mail records, certificates and your public website. You connect your cloud, or drop documents in, when you are ready to collect evidence.

No. Cylanto keeps your evidence current, mapped and traceable, so your auditor spends their time verifying rather than chasing. Certification is still issued by an independent auditor, and you can give yours read-only access.

Pricing is tailored to your organisation. Talk to us for a quote.

Email and password with multi-factor authentication, or single sign-on (SAML) through your own identity provider.

For password sign-in, multi-factor authentication is mandatory: after your password, you enter a six-digit code from an authenticator app such as Microsoft Authenticator, Google Authenticator or 1Password.

At least 12 characters, up to 128, and not your email address.

We follow NIST SP 800-63B: length is what makes a password strong, so we don't force a mix of symbols and numbers, or regular changes. A passphrase of a few unrelated words is long, strong and easy to remember.

After 10 failed attempts, the account is locked for 15 minutes.

Up to 12 hours, then you sign in again. Signing out ends the session on our servers immediately, not just in your browser.

Contact us. We verify your identity before resetting multi-factor authentication. A password reset alone never bypasses it.

Yes. Access is role-based, and nobody sees anything their role doesn't grant.

Every organisation starts with five groups: Administrators, Compliance managers, Control owners, Contributors and Auditors (read-only). Your administrators decide who belongs to each.

Yes. An IP allow-list limits access to your organisation's approved networks.

Yes. Our team configures the model behind each AI persona, so it can match your organisation's AI policy or approved-vendor list. Tell us your requirements when you onboard.

Yes. A persona's framing (its role, focus, tone and the frameworks it speaks for) and the model behind it can be customised by our team.

Out of the box you get a GDPR Expert, PCI DSS Expert, ISO 27001 Expert, NIST CSF Expert and a Compliance Advisor.

From your own records. Retrieval over your policies, contracts, evidence and prior decisions grounds every answer, and each claim cites the exact document and page behind it. Where your records are silent, the answer says so rather than guessing.

No. Your inputs, outputs, prompts and uploaded documents are never used to train the underlying models.

On Amazon Web Services (AWS). AI requests are processed by our model provider under a commercial agreement that forbids training on your data.

Yes, in transit and at rest.

• All traffic uses HTTPS, and plain-HTTP requests are redirected.
• The database, its backups and your evidence files are encrypted with AES-256, using AWS Key Management Service (KMS) keys dedicated to the platform and rotated automatically.
• Evidence storage refuses unencrypted connections and is closed to public access.
• Credentials are kept in AWS Secrets Manager, and passwords are stored only as salted scrypt hashes.

Yes. Cylanto is multi-tenant by design, and each organisation's data is isolated from every other's.

• Every record carries its organisation's identifier, and row-level security, enforced inside the database itself, means a query can only ever return your organisation's rows.
• Evidence files are stored under a separate path for each organisation.
• Governance controls on top, such as IP allow-listing, role-based access and audit logging, decide who reaches your data, and from where.

Yes. Sign-ins, user and group changes, evidence reviews and other key actions are written to an append-only audit log, with the time, the person and their IP address. Anyone with audit permission, including your auditors, can review it.

You do. You decide what is uploaded, define how long it is retained, and delete it when you choose.

Yes. Your data can be kept within your required geographic region. Tell us your residency requirements when you onboard.